CVE-2026-73218 in Cursor
Summary
by MITRE • 08/11/2026
Cursor is a code editor built for programming with AI. Prior to 3.0.0, Cursor IDE for macOS allows an agent running in Auto-Run Sandbox mode, when Docker Desktop and the Dev Containers CLI are installed, to launch a privileged container and mount Docker's virtiofs0, granting read and write access to the user's home directory and enabling host command execution with the user's privileges without an additional permission prompt. This issue is fixed in version 3.0.0.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/11/2026
The vulnerability described affects Cursor IDE versions prior to 3.0.0 on macOS systems, representing a critical privilege escalation flaw within the application's sandboxing mechanism. This security weakness specifically manifests when the Auto-Run Sandbox mode is active and Docker Desktop along with the Dev Containers CLI are installed on the system. The flaw stems from improper privilege management within the application's container execution workflow, where an unprivileged agent operating under the Auto-Run sandbox can inadvertently launch privileged containers that bypass normal security boundaries.
The technical implementation of this vulnerability involves the exploitation of Docker's virtiofs0 mounting mechanism, which provides a high-performance file system interface between host and container environments. When the vulnerable Cursor IDE executes commands in Auto-Run mode with Docker tools present, it allows the creation of containers that can mount the user's home directory through virtiofs0 with full read-write privileges. This mounting operation creates a direct pathway for arbitrary command execution on the host system with the privileges of the user running the application. The vulnerability essentially eliminates the sandboxing protections that should normally isolate potentially malicious code execution from the underlying operating system.
From an operational perspective, this vulnerability represents a severe risk to macOS users who employ Cursor IDE with Docker integration features. Attackers could exploit this flaw to execute arbitrary commands on target systems with elevated privileges, potentially leading to complete system compromise. The absence of additional permission prompts means that legitimate user interactions do not trigger security warnings, making the exploitation process more stealthy and automated. This vulnerability affects users who have both Docker Desktop and Dev Containers CLI installed, which are common tools among developers, thereby expanding the potential attack surface significantly.
The root cause of this issue aligns with CWE-276, which addresses improper privileges and access control mechanisms in software applications. The flaw demonstrates poor privilege separation between sandboxed execution environments and privileged container operations, creating an attack vector that directly violates basic security principles of least privilege and isolation. From an ATT&CK framework perspective, this vulnerability maps to T1059 for command and scripting interpreter usage and T1548.001 for abuse of privileges, as it enables attackers to execute commands with elevated system privileges without traditional escalation techniques.
The mitigation strategy involves upgrading to Cursor IDE version 3.0.0 or later, which implements proper privilege controls and sandboxing mechanisms to prevent unauthorized container privilege escalation. Users should also consider disabling Auto-Run Sandbox mode when Docker tools are present on their systems, or implementing additional security measures such as restricting Docker access to specific user groups or using Docker daemon configurations that limit host mount capabilities. Organizations should conduct vulnerability assessments to identify affected installations and ensure proper patch management protocols are in place to prevent exploitation of this privilege escalation flaw.